CVE-2024-43362

CVE-2024-43362 is a stored cross-site scripting (XSS) flaw in Cacti, an open-source performance and fault management framework, caused by insufficient sanitization of the `fileurl` parameter when external links are saved in `links.php`. An authenticated user with permission to create external links can submit a crafted `fileurl` in an HTTP POST; the stored value is later embedded in HTML that is passed to the `print` function in `link.php` and `index.php`, so attacker-controlled script executes whenever other users view those pages. Successful exploitation lets the attacker run arbitrary JavaScript in victims' browsers within the Cacti origin, enabling session hijacking or actions performed with the victim's privileges; planting the payload requires low privileges and viewing the malicious link requires user interaction. Any Cacti deployment running versions prior to 1.2.28 is affected, with the issue fixed in 1.2.28. No in-the-wild exploitation is confirmed so far; a public PoC accompanies the GitHub advisory, and an EPSS of 36.5% (98th percentile) indicates an elevated likelihood of near-term exploitation.

What to do: Upgrade to Cacti 1.2.28 or later; the advisory notes there are no known workarounds. In the interim, restrict permission to create external links to trusted users and audit existing external links for unexpected HTML/scripts in the fileurl field, since injected payloads persist until removed. Monitor the estate closely, as the high EPSS score suggests exploitation attempts are likely within the next 30 days.